3 ms·

Had a food startup in the Netherlands. Worked with PostNL, the main and previous governmental organisation for sending mail. Weekly we would upload our orders

Had a food startup in the Netherlands. Worked with PostNL, the main and previous governmental organisation for sending mail. Weekly we would upload our orders in their system; and could see our history. Then one day we could suddenly access all other clients history and export their users data. Many of them direct competitors, and their mailing lists would have been quite valuable to us. My partner exported all Marley Spoon's (a bigger funded competitor) data in excel and a few others. When he told me I told him to delete it ASAP, even though it's fun you don't create a liability. But we could have used it to grow 10-30% in a few weeks. They never reported it, which they were legally obliged to do under EU law. All to say, if you get the keys to the castle, maybe don't use them. Or maybe you do. We should, and could have used it, in price negotiations since they almost doubled the prices to us for the next few months and didn't have any mercy. Let alone misplacing 3-8% of our orders and not refunding. But instead we moved to few other delivery services (with all their own flaws)

jeroenhd 3y ago
You can anonymously tip the Autoriteit Persoonsgegevens and let them look into the issue if you're afraid of repercussions. Any screenshot containing evidence of PII being leaked will certainly help, and I doubt PostNL will have fixed their terrible terrible systems. Under Dutch law your colleague would've committed a crime by downloading the data he knew he shouldn't be allowed to access, beyond what was necessary to conclude that there was a leak. "Using" this indo during negotiations would've been blackmail, which is very much a thing you wouldn't want to do, especially with a company that big and without real competition; they'd go to the police, and you'd be screwed.
- wouldbecouldbe 3y ago
  You can subtly mention things to alter the dynamics of a conversation without it being blackmail ;). Or forcefully making demands and wanting proof that our data is safe. To report it now, it's so many years back by now, not worth the trouble and proof is gone. But they were so disrespectful to us regarding not wanting to refund a lot of lost orders while at the same time doubling prices, that I almost reported them out of spite.

jeroenhd 3y ago

You can anonymously tip the Autoriteit Persoonsgegevens and let them look into the issue if you're afraid of repercussions. Any screenshot containing evidence of PII being leaked will certainly help, and I doubt PostNL will have fixed their terrible terrible systems. Under Dutch law your colleague would've committed a crime by downloading the data he knew he shouldn't be allowed to access, beyond what was necessary to conclude that there was a leak. "Using" this indo during negotiations would've been blackmail, which is very much a thing you wouldn't want to do, especially with a company that big and without real competition; they'd go to the police, and you'd be screwed.

wouldbecouldbe 3y ago
You can subtly mention things to alter the dynamics of a conversation without it being blackmail ;). Or forcefully making demands and wanting proof that our data is safe. To report it now, it's so many years back by now, not worth the trouble and proof is gone. But they were so disrespectful to us regarding not wanting to refund a lot of lost orders while at the same time doubling prices, that I almost reported them out of spite.